Privacy notice

Introduction

This is the general privacy notice of Forestry and Land Scotland (FLS, “we”, “us”, “our”) established by the Forestry and Land Management (Scotland) Act 2018 and having our principal place of business at 1 Highlander Way, Inverness Business Park, Inverness, IV2 7GB.

This privacy notice explains your rights under the Data protection Act 2018 (DPA) and General Data Protection Regulation (GDPR). It describes how we gather, use and share your personal information that we may hold and includes any personal information we already hold. We are committed to protecting and respecting your privacy.

Forestry and Land Scotland is registered with the Information Commissioner (registration number Z4857137) under Scottish Ministers, to handle your data.

Our reasons for handling your data

We’ll use your personal information where:

you have entered into a contract with us

it is required by law (legal obligation)

it is necessary to perform our statutory duties (public task)

you, or your legal representative, have given us consent

Some of the information that we process is classed as ‘special category data’. Where we process this type of information, we rely on either your consent or on a condition set out in the DPA, such as medical or equality and diversity information, and will have safeguards in place.

There may be occasions where we ask for consent, for example, if you have signed up to a mailing list. You have the right to withdraw this consent at any time.

What data we collect from you

We may process several categories of personal information depending on the purpose, that may include:

If we collect personal information from other sources we will inform you.

How we use your data

We process your data for a number of purposes:

volunteer services

developing policy and undertaking consultations

providing advice and information and undertaking research

the use of CCTV and mobile systems for crime prevention

investigation of complaints and accidents

land management

undertaking commercial activities

carrying out our obligations arising from any contracts entered into by you and us

notifying you of changes to our services

sending you communications which you have requested and that may be of interest to you

and all activities that we are required to carry out as a controller and as a public authority.

When we share personal data

On occasion we may need to share your information with other organisations for statutory or regulatory reasons, or because it is in the public interest. Sharing will be carried out lawfully and securely and we will only disclose the personal information that is necessary for that particular purpose.

We will not sell or rent your information to third parties and we will not share your information with third parties for marketing purposes.

Some of our applications are provided by third parties. If you click on any links to third party websites from our website, we encourage you to read the privacy policy statements contained on those sites.

Do you transfer my personal data outside of the European Economic Area?

There may be instances where personal information is stored outside the European Economic Area. In most cases personal information is not transferred or stored outside of the European Economic Area. If your personal information is processed outside the United Kingdom or European Economic Area, you will be informed of this and the safeguards that are in place.

How long we will keep your data and how we decide this

We will keep your personal information only for as long as it is needed. The length of time may vary across the organisation, depending on the reason for collecting or holding the personal information. When we no longer need personal information, arrangements are made to securely delete or destroy it. Retention periods are set in line with statutory, regulatory, legal, security reasons or for their historic value.

What are the consequences if I do not provide the requested personal data?

If you do not provide the requested personal information it is more than likely that the service you wish to use will not be available to you. We try to ensure that we only collect the minimum personal information that is necessary.

Will my data be used for automated decision making?

Your personal data may be subject to automated decision making. You will be informed where automated decision making applies including profiling, and the envisaged consequences of such processing.

What are my rights?

Under certain circumstances, you have the right to:

request access to the personal information we hold about you (known as a ‘subject access request’)

request that your personal information be corrected or updated if you believe it is inaccurate or incomplete

request your personal information be deleted

ask us to stop processing your personal information

ask us to restrict the processing of your personal information

ask us for the personal information that we hold about you to reuse it for your own purposes

How to contact us about your data

You have a right to access your personal data and ask us to see the data we hold about you. You will not have to pay to get your data. In some cases, however, we may refuse your request in line with the DPA.

You can contact our Data Protection Officer at:

Head of Records and Data Protection Forestry and Land Scotland Silvan House 231 Corstorphine Road Edinburgh EH12 7AT

Email This email address is being protected from spambots. You need JavaScript enabled to view it.

You can contact the Information Commissioner if you are concerned about how we process your data. To lodge a complaint with the independent Information Commissioner (ICO), please go to www.ico.org.uk/make-a-complaint

Changes to this privacy notice

We regularly review this privacy notice and if anything changes we will update this notice to reflect the change.